CVE-2026-7202
Published: 28 April 2026
Summary
CVE-2026-7202 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A8000RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 17.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
A vulnerability has been identified in the Totolink A8000RU router running firmware version 7.1cu.643_b20200521. It resides in the setWiFiWpsStart function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component. The flaw stems from improper handling of the wscDisabled argument, which permits OS command injection and is tracked under CWE-77 and CWE-78. The issue received a CVSS 4.0 score of 8.9 and can be triggered over the network without authentication.
An unauthenticated remote attacker can supply a crafted request to the CGI endpoint to execute arbitrary operating system commands on the device. Successful exploitation grants full control over the router, enabling actions such as configuration changes, traffic interception, or use of the device as a pivot point. Public proof-of-concept code has already been released, indicating the attack is feasible with readily available tools.
The EPSS score remains low at 0.0122 with a peak of only 0.0125, showing no significant rise in observed exploitation interest. Vendor references point to the Totolink support site, though no specific patch or mitigation guidance is detailed in the available disclosures.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25959
Vulnerability details
A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setWiFiWpsStart of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument wscDisabled leads to os command injection. The attack can be initiated remotely.…
more
The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables unauthenticated remote exploitation of a public-facing web application (T1190) leading to arbitrary OS command execution on a likely Unix/Linux-based router (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly blocks the unsanitized wscDisabled argument from reaching the shell in setWiFiWpsStart, preventing OS command injection.
Enforces authentication and authorization checks before any request reaches /cgi-bin/cstecgi.cgi, eliminating the unauthenticated remote attack path.
Boundary-protection mechanisms (e.g., ACLs or WAF rules) can restrict external access to the router's management CGI endpoints.